include check for 'risky' upload files